Connect a connector

Outcome

Connect an optional connector to the current workspace, or change its configuration. topolo_crm lets threads.handoff kind crm_deal create a TopoloCRM deal (linked to the contact with the same email address when one exists); crmWorkspaceId picks the TopoloCRM workspace, omitted means the person's default one. No credential is stored: each CRM call forwards the signed-in person's own token. Before saving, Engage reads one TopoloCRM contact as that person: 403 crm_access_denied when TopoloCRM refuses them (401 without a person's credential), 502 crm_unavailable when it cannot be reached; nothing is saved then. 409 connector_unavailable when this deploy is not configured for the connector. Undo with connectors.disconnect. Audited. Connectors are optional: Engage works fully without them, and its own suppression list stays the source of truth (nothing about suppression is written to TopoloCRM).

Before you start

• Verify the intended environment, signed-in credential, authorized organization and the action permission workspace:write.
• Discover and select an authorized canonical Engage workspace. Pass resourceType=workspace and resourceId separately from action input.
• Review the exact effects and obtain approval before CLI --confirm or MCP confirm:true. A local capture does not authorize a live mutation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_engage.connectors.connect --json
topolo workspaces list topolo-engage --json

Set ENGAGE_WORKSPACE_ID to the identifier of the selected authorized workspace.

Input contract

Validate, plan and execute

Build payload.json from the current schema and discovered identifiers. The action description above defines its behavior, limits, side effects and declared errors.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions validate app_topolo_engage.connectors.connect --data @payload.json --json
topolo actions plan app_topolo_engage.connectors.connect --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

Review the plan and approve its exact effects before executing the unchanged request.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions call app_topolo_engage.connectors.connect --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

For MCP, use topolo_get_action, topolo_validate_action, topolo_plan_action and topolo_call_action. Pass resource context separately where required; confirm:true is required for mutations.

Captured successful requests and responses

Captured HTTP 200 · connector actions > lists TopoloCRM as available but not connected, then connects, reconfigures and disconnects it with audit

Action input

{
  "connectorId": "topolo_crm"
}

Actual local response

{
  "connector": {
    "id": "topolo_crm",
    "name": "TopoloCRM",
    "available": true,
    "connected": true,
    "config": {
      "crmWorkspaceId": null
    },
    "connectedBy": "user_1",
    "connectedAt": "2026-10-01T09:00:00.000Z"
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 200 · connector actions > checks the person can read TopoloCRM, as them and in the chosen CRM workspace, before saving

Action input

{
  "connectorId": "topolo_crm",
  "crmWorkspaceId": "crm_ws_9"
}

Actual local response

{
  "connector": {
    "id": "topolo_crm",
    "name": "TopoloCRM",
    "available": true,
    "connected": true,
    "config": {
      "crmWorkspaceId": "crm_ws_9"
    },
    "connectedBy": "user_1",
    "connectedAt": "2026-10-01T09:00:00.000Z"
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Effects and response meaning

• Connect an optional connector to the current workspace, or change its configuration. topolo_crm lets threads.handoff kind crm_deal create a TopoloCRM deal (linked to the contact with the same email address when one exists); crmWorkspaceId picks the TopoloCRM workspace, omitted means the person's default one. No credential is stored: each CRM call forwards the signed-in person's own token. Before saving, Engage reads one TopoloCRM contact as that person: 403 crm_access_denied when TopoloCRM refuses them (401 without a person's credential), 502 crm_unavailable when it cannot be reached; nothing is saved then. 409 connector_unavailable when this deploy is not configured for the connector. Undo with connectors.disconnect. Audited. Connectors are optional: Engage works fully without them, and its own suppression list stays the source of truth (nothing about suppression is written to TopoloCRM).

Verify the outcome

• Check the response against the declared output schema and the requested operation. For mutations, use the action-specific read described in the action description before any dependent operation.

Recover

For an uncertain result, inspect current retained state with a read action before retrying. Do not replay a mutation unless its contract explicitly guarantees idempotency.

Refused requests

Captured HTTP 403 · connector actions > saves nothing when TopoloCRM is refused

Action input

{
  "connectorId": "topolo_crm"
}

Actual local response

{
  "error": {
    "code": "crm_access_denied",
    "message": "TopoloCRM refused your access. Check your CRM permissions.",
    "details": {
      "connectorId": "topolo_crm"
    }
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 502 · connector actions > saves nothing when TopoloCRM is unreachable

Action input

{
  "connectorId": "topolo_crm"
}

Actual local response

{
  "error": {
    "code": "crm_unavailable",
    "message": "TopoloCRM could not be reached.",
    "details": {
      "connectorId": "topolo_crm"
    }
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 401 · connector actions > needs a signed-in person to connect TopoloCRM and rethrows unexpected failures

Action input

{
  "connectorId": "topolo_crm"
}

Actual local response

{
  "error": {
    "code": "crm_access_denied",
    "message": "Connecting TopoloCRM needs a signed-in person's credential."
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 409 · connector actions > refuses to connect when this deploy has no TopoloCRM origin

Action input

{
  "connectorId": "topolo_crm"
}

Actual local response

{
  "error": {
    "code": "connector_unavailable",
    "message": "TopoloCRM is not available in this deploy. Engage keeps working without it.",
    "details": {
      "connectorId": "topolo_crm"
    }
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 403 · connector actions > lets a reader list but not change, validates input and ignores other routes

Action input

{
  "connectorId": "topolo_crm"
}

Actual local response

{
  "error": {
    "code": "permission_denied",
    "message": "The credential lacks workspace:write.",
    "details": {
      "requiredPermission": "workspace:write"
    }
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 422 · connector actions > lets a reader list but not change, validates input and ignores other routes

Refused input; do not execute

{
  "connectorId": "salesforce"
}

Actual local response

{
  "error": {
    "code": "invalid_action_input",
    "message": "Input for connectors.connect is invalid.",
    "details": [
      {
        "code": "invalid_value",
        "values": [
          "topolo_crm"
        ],
        "path": [
          "connectorId"
        ],
        "message": "Invalid input: expected \"topolo_crm\""
      }
    ]
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 422 · connector actions > lets a reader list but not change, validates input and ignores other routes

Refused input; do not execute

{}

Actual local response

{
  "error": {
    "code": "invalid_action_input",
    "message": "Input for connectors.connect is invalid.",
    "details": []
  }
}

Source test: connectors.test.ts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Error recovery

• HTTP 403 crm_access_denied: Read the refusal details and current action contract, correct the stated cause, then validate and plan again. Do not retry unchanged or infer success.
• HTTP 502 crm_unavailable: Preserve the request and inspect the declared dependency state. Retry only after the transient or configuration cause is resolved; do not infer that the operation completed.
• HTTP 401 crm_access_denied: Read the refusal details and current action contract, correct the stated cause, then validate and plan again. Do not retry unchanged or infer success.
• HTTP 409 connector_unavailable: Preserve the request and inspect the declared dependency state. Retry only after the transient or configuration cause is resolved; do not infer that the operation completed.
• HTTP 403 permission_denied: Stop and inspect the current credential and selected resource. It needs workspace:write; do not broaden access or switch organization automatically.
• HTTP 422 invalid_action_input: Correct the request against the current action input schema, then validate it again before planning.

Related actions

• List connectors
• Disconnect a connector

Evidence and limits

• /api/connectors/connect

• connectors.test.ts

• Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

• Widget/bootstrap use actual app handler but mocked worker runtime and app identity.

• No gateway execution, live permissions, external delivery or deployed proof.

These are local route captures with synthetic identity and simulated dependencies. They do not prove live authorization, gateway execution, production state, or external delivery.